When it comes to malware, your Mac might be less vulnerable than your average Windows OC, but that doesn’t mean it’s immune. There are all kinds of malware that can find their way onto it and cause you anything from a little inconvenience to compromised privacy and even financial loss. Malware comes in various forms, including browser hijackers, ransomware, and crypto miners. But there is one type that is more prevalent than any of those — adware. Pipidae is an example of a particularly intrusive form of adware that displays unwanted adverts on your Mac and may attempt to steal data. In this article, we’ll show you how to remove Pipidae malware from your Mac.

What is Pipidae?

Pipidae is part of a group of adware programs known as Pirrit or OSX.Pirrit. Like other forms of adware, Pirrit and Pipidae display unwanted and intrusive adverts on your Mac. These adverts aren’t just an inconvenience. If you mistakenly click one, it could lead to downloading more malware as well as the theft of your personal data. It will also degrade the performance of your Mac because, like most malware, Pipidae consumes significant levels of macOS resources like CPU cycles and memory. That leaves fewer resources for other applications and services and so slows your Mac down.

How did Pipidae get onto my Mac?

Adware like Pipidae is distributed in several different ways. It’s most likely to have found its way onto your Mac when you clicked a link in an email, text message, or on a website. It could have also been packaged with software you downloaded, believing it to be legitimate. Some browser extensions can also distribute malware.

How do I know if Pipidae is on my Mac?

The first sign that something is amiss may have been a message from Gatekeeper in macOS warning you that the software you were trying to install came from an unidentified developer. You shouldn’t ignore that warning. It’s possible that the software is legitimate, but you should always make absolutely certain before overriding Gatekeeper and going ahead with the installation. Other symptoms of Pipidae on your Mac may include:

  • Your Mac slowing down, hanging, or becoming unstable
  • Unwanted adverts appearing
  • Your browser settings, such as the default homepage and search engine, changing

How to remove Pipidae malware from your Mac

There are a number of steps needed to remove Pipidae from your Mac. You should check whether it has installed any profiles or browser extensions and whether it has changed your browser settings. You will also need to scan your Mac for malware. We’ll show you how to do all of that.

1. Use Activity Monitor to quit suspicious processes

Activity Monitor lists all the processes running on your Mac at any given time. Most of the processes have names you won’t recognize, so that on its own isn’t an indication of suspicious activity. However, if a process is using a huge percentage of your Mac’s resources, it could be an indication that it is malware. If you see a process like that, take note of its name and Google it. If it seems suspicious after that, select it in Activity Monitor and click the ‘x’ in the toolbar.  

2. Check your Applications folder

    Most malware doesn’t install applications in your Applications folder. However, it’s worth checking. Open the folder and look for any application that you don’t remember installing. If you find one that looks suspicious, drag it to the Trash.

    3. Check whether Pipidae has installed a profile on your Mac

    Malware can create accounts on your Mac, so it’s worth checking that, too.

    1. Click the Apple menu and choose System Settings,
    2. Choose Privacy & Security, scroll to the bottom of the window, and click Profiles.
    3. Look for any profiles listed there.
    4. If you see one you don’t recognize or shouldn’t be there, select it and click ‘-’.
    5. Quit System Settings.

    4. Check for browser extensions

    You will need to check extensions on every browser installed on your Mac. Look for extensions you don’t remember installing or that seem suspicious. We’ll show you how to do that for Safari, Chrome, and Firefox. The process for other browsers is similar to that for Chrome and Firefox.

    Safari

    1. Click the Safari menu and choose Settings.
    2. Go to Extensions.
    3. Choose the extension you want to remove and click Uninstall.

    Chrome

    1. Open Chrome and click the more icon (three dots) to the right of the address bar.
    2. Choose Extensions > Manage Extensions.
    3. Locate the extension you want to uninstall and click Remove.

    Firefox

    1. Open Firefox and click the three lines to the right of the address bar.
    2. Choose Add-ons and themes and then Extensions.
    3. Select Extensions in the sidebar.
    4. When you find the extension you want to uninstall, click the three dots next to it and choose Remove.

    5. Reset browser settings

    The next step is to reset the default homepage and search engine for each browser if they have been changed. Here’s how to do that in Safari, Chrome, and Firefox.

    Safari

    1. Click the Safari menu and choose Settings > General.
    2. Next to Homepage, type the address of the page you want as your homepage or click Set to Current Page.
    3. Click Search in the toolbar.
    4. Choose the search engine you want to use as the default.
    5. Quit Settings.

    Chrome

    1. Open Chrome and click the more icon.
    2. Choose Settings, then from the sidebar, go to On startup.
    3. To set a URL for a start page, choose Open a specific page or set of pages and type in the URL.
    4. Then, go to Search engine and set it to your preference.
    5. Close Settings.

    Alternatively, you can click Reset settings in the sidebar and restore settings to the original there.

    Firefox

    1. Open Firefox and click the three lines to the right of the address bar.
    2. Choose Settings and then, in the sidebar on the left, choose Home.
    3. Next to Homepage and new windows, choose Custom URLs.
    4. Type in the URL of the page you want as your homepage.
    5. Next, check the search engine by going to Search from the sidebar.
    6. Close Settings.

    Check your Mac for malware

    Once you’ve removed suspicious browser extensions and profiles and reset your browser homepage and default search engine, an extra step is to scan your Mac for malware so you can get rid of the files Pipidae has placed on your Mac or any other malware that may have sneaked on your Mac.

    You will need to use a specialist tool for that. We recommend CleanMyMac X’s Malware Removal module. It scans your Mac looking for adware, ransomware, cryptocurrency miners, and other malware and compares the results with a database of known malware. It then allows you to remove any malware it finds with one click. You can use it to run ad-hoc scans, or you can set it to run in the background and check for malware automatically. And you can specify whether you want it to carry out a deep scan, a quick scan or a balanced scan.

    You can download CleanMyMac X for free here. Once you’ve downloaded and installed it, open it and choose Malware Removal. Click Scan to start a scan or Configure to set options. If CleanMyMac X finds anything, click the Remove button.

    adware found with malware removal module of CleanMyMac

    Pipidae is a type of adware that, once on your Mac, will display intrusive adverts and attempt to persuade you to click malicious links. Follow the steps above to remove Pipidae malware from your Mac and clear out any other malware you may have downloaded.